Bug 574808

Summary:	sys-devel/gcc-{4.9.3,5.3.0} Java supplementary executables (gij, ecj1) need PaX marks
Product:	Gentoo Linux	Reporter:	Karl-Johan Karlsson <creideiki+gentoo-bugzilla>
Component:	Hardened	Assignee:	The Gentoo Linux Hardened Team <hardened>
Status:	RESOLVED FIXED
Severity:	normal	CC:	akarmn, laine.gholson
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Karl-Johan Karlsson 2016-02-15 18:26:44 UTC

While trying to emerge dev-java/ecj-gcj-4.4.2 on a hardened system, the build process died with:

>>> Compiling source in /var/tmp/portage/dev-java/ecj-gcj-4.4.2/work ...
 * bootstrapping ecj with gcj ...
gcj: internal compiler error: Killed (program ecj1)
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://bugs.gentoo.org/> for instructions.
 * ERROR: dev-java/ecj-gcj-4.4.2::gentoo failed (compile phase):
 *   (no error message)
 * 
 * Call stack:
 *     ebuild.sh, line 133:  Called src_compile
 *   environment, line 3693:  Called die
 * The specific snippet of code:
 *       "${gcj}" -w -C -fsource=${JAVA_PKG_WANT_SOURCE} -d bootstrap @sources.lst || die;
 * 
 * If you need support, post the output of `emerge --info '=dev-java/ecj-gcj-4.4.2::gentoo'`,
 * the complete build log and the output of `emerge -pqv '=dev-java/ecj-gcj-4.4.2::gentoo'`.
!!! When you file a bug report, please include the following information:
GENTOO_VM=  CLASSPATH="" JAVA_HOME=""
JAVACFLAGS="" COMPILER=""

According to dmesg, this is due to PaX:

[34970.775103] PAX: execution attempt in: <anonymous mapping>, 387d163a000-387d169a000 387d163a000
[34970.775106] PAX: terminating task: /usr/libexec/gcc/x86_64-pc-linux-gnu/5.3.0/ecj1(ecj1):18378, uid/euid: 250/250, PC: 00000387d16993b0, SP: 000003da0744f928
[34970.775108] PAX: bytes at PC: 4c 8d 15 f9 ff ff ff ff 25 03 00 00 00 0f 1f 00 c8 45 47 d4 
[34970.775117] PAX: bytes at SP-8: 000003da0744f960 00000387d397762a 00000387d6da1700 069d17564b952400 000003da0744f960 00000387d6e54dc0 00000387d6e54f00 00000387d6da1700 000003da0744f9a0 00000387d39fa95c 000003da0744f9b0 

# paxctl-ng -v /usr/libexec/gcc/x86_64-pc-linux-gnu/5.3.0/ecj1
/usr/libexec/gcc/x86_64-pc-linux-gnu/5.3.0/ecj1:
        PT_PAX    : -e---
        XATTR_PAX : not found

Setting PaX mark -m on that binary gives another PaX error:

>>> Compiling source in /var/tmp/portage/dev-java/ecj-gcj-4.4.2/work ...
 * bootstrapping ecj with gcj ...
 * building ecj with bootstrapped ecj ...
/var/tmp/portage/dev-java/ecj-gcj-4.4.2/temp/environment: line 3688: 20724 Killed                  "${gccbin}/gij" -cp bootstrap:. org.eclipse.jdt.internal.compiler.batch.Main -nowarn $(java-pkg_javac-args) @sources.lst
 * ERROR: dev-java/ecj-gcj-4.4.2::gentoo failed (compile phase):
 *   (no error message)
 * 
 * Call stack:
 *     ebuild.sh, line 133:  Called src_compile
 *   environment, line 3695:  Called die
 * The specific snippet of code:
 *       "${gccbin}/gij" -cp bootstrap:. org.eclipse.jdt.internal.compiler.batch.Main -nowarn $(java-pkg_javac-args) @sources.lst || die;
 * 
 * If you need support, post the output of `emerge --info '=dev-java/ecj-gcj-4.4.2::gentoo'`,
 * the complete build log and the output of `emerge -pqv '=dev-java/ecj-gcj-4.4.2::gentoo'`.
!!! When you file a bug report, please include the following information:
GENTOO_VM=  CLASSPATH="" JAVA_HOME=""
JAVACFLAGS="" COMPILER=""

[35473.692199] PAX: execution attempt in: <anonymous mapping>, 36e7c2a2000-36e7c313000 36e7c2a2000
[35473.692202] PAX: terminating task: /usr/x86_64-pc-linux-gnu/gcc-bin/5.3.0/gij(gij):20724, uid/euid: 250/250, PC: 0000036e7c2cf2b0, SP: 000003e0e3e6b438
[35473.692204] PAX: bytes at PC: 4c 8d 15 f9 ff ff ff ff 25 03 00 00 00 0f 1f 00 c8 e5 a3 7a 
[35473.692211] PAX: bytes at SP-8: 000003e0e3e6b470 0000036e79f4162a 0000036e7c356580 52fba07f8b644c00 000003e0e3e6b470 0000036e7c327dc0 0000036e7c327f00 0000036e7c356580 000003e0e3e6b4b0 0000036e79fc495c 000003e0e3e6b4c0 

# paxctl-ng -v /usr/x86_64-pc-linux-gnu/gcc-bin/5.3.0/gij
/usr/x86_64-pc-linux-gnu/gcc-bin/5.3.0/gij:
        PT_PAX    : -e---
        XATTR_PAX : not found

Adding -m to that one as well lets the build process continue.

The GCJ binary itself also isn't PaX marked, but apparently that isn't a problem:

# paxctl-ng -v /usr/x86_64-pc-linux-gnu/gcc-bin/5.3.0/x86_64-pc-linux-gnu-gcj
/usr/x86_64-pc-linux-gnu/gcc-bin/5.3.0/x86_64-pc-linux-gnu-gcj:
        PT_PAX    : -e---
        XATTR_PAX : not found

I get the same results for both GCC 5.3.0 and 4.9.3.

# emerge --info sys-devel/gcc
Portage 2.2.27 (python 3.4.3-final-0, hardened/linux/amd64, gcc-5.3.0, glibc-2.22-r1, 4.3.5-hardened-r2 x86_64)
=================================================================
                         System Settings
=================================================================
System uname: Linux-4.3.5-hardened-r2-x86_64-Intel-R-_Core-TM-_i7-4770K_CPU_@_3.50GHz-with-gentoo-2.2
KiB Mem:    32886732 total,  13855392 free
KiB Swap:   33521660 total,  33521660 free
Timestamp of repository gentoo: Mon, 15 Feb 2016 17:00:01 +0000
sh bash 4.3_p42-r2
ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1
app-shells/bash:          4.3_p42-r2::gentoo
dev-java/java-config:     2.2.0::gentoo
dev-lang/perl:            5.22.1::gentoo
dev-lang/python:          2.7.11-r2::gentoo, 3.4.3-r7::gentoo, 3.5.1-r2::gentoo
dev-util/cmake:           3.4.3::gentoo
dev-util/pkgconfig:       0.29::gentoo
sys-apps/baselayout:      2.2::gentoo
sys-apps/openrc:          0.20.4::gentoo
sys-apps/sandbox:         2.10-r1::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r1::gentoo
sys-devel/automake:       1.11.6-r1::gentoo, 1.12.6-r1::gentoo, 1.13.4::gentoo, 1.14.1-r1::gentoo, 1.15-r1::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo
sys-devel/gcc:            4.9.3::gentoo, 5.3.0::gentoo
sys-devel/gcc-config:     1.8-r1::gentoo
sys-devel/libtool:        2.4.6-r2::gentoo
sys-devel/make:           4.1-r1::gentoo
sys-kernel/linux-headers: 4.4::gentoo (virtual/os-headers)
sys-libs/glibc:           2.22-r1::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000
    sync-rsync-extra-opts: --timeout=10 --ipv6

creideiki
    location: /usr/local/portage
    masters: gentoo
    priority: 0

steam-overlay
    location: /var/lib/layman/steam-overlay
    sync-type: laymansync
    sync-uri: git://github.com/anyc/steam-overlay.git
    masters: gentoo
    priority: 50

torbrowser
    location: /var/lib/layman/torbrowser
    sync-type: laymansync
    sync-uri: git://github.com/MeisterP/torbrowser-overlay.git
    masters: gentoo
    priority: 50

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="* -@EULA"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=native -O2 -pipe -ggdb"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/config /usr/share/gnupg/qualified.txt"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo"
CXXFLAGS="-march=native -O2 -pipe -ggdb"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--alphabetical --keep-going --quiet-build=n --backtrack=30 --verbose-conflicts"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs buildpkg compressdebug config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu -Wl,--enable-new-dtags"
MAKEOPTS="-j8"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_EXTRA_OPTS="--timeout=10 --ipv6"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git"
PORTAGE_TMPDIR="/var/tmp"
USE="X acl alsa amd64 berkdb bluray bzip2 cli cracklib crypt cups cxx dri dvd emacs exif ffmpeg flac gdbm gif hardened iconv idn ipv6 jpeg jpeg2k justify kde mmx mmxext mng modules multilib ncurses nls nptl ogg opengl openmp pam pax_kernel pcre pdf pie png postscript qt4 readline seccomp session sse sse2 ssl ssp svg tcpd tiff unicode urandom vaapi vdpau vorbis wmf xattr xpm xtpax zlib" ABI_X86="64 32" ALSA_CARDS="hda-intel" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="braindump flow karbon kexi krita sheets stage words" CAMERAS="canon" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="aes avx avx2 fma3 mmx mmxext popcnt sse sse2 sse3 sse4_1 sse4_2 ssse3" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev wacom" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en en_US en_GB en_UK sv sv_SE" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_4" QEMU_SOFTMMU_TARGETS="i386 x86_64" RUBY_TARGETS="ruby20 ruby21" SANE_BACKENDS="pixma hp" USERLAND="GNU" VIDEO_CARDS="nvidia" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account"
Unset:  CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LANG, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, USE_PYTHON

=================================================================
                        Package Settings
=================================================================

sys-devel/gcc-4.9.3::gentoo was built with the following:
USE="(-altivec) (-awt) -cilk cxx -debug -doc (-fixed-point) fortran gcj -go -graphite hardened (-libssp) (multilib) (-multislot) nls -nopie -nossp nptl -objc -objc++ -objc-gc openmp (pie) -regression-test (-sanitize) (ssp) -vanilla" ABI_X86="64"


sys-devel/gcc-5.3.0::gentoo was built with the following:
USE="(-altivec) (-awt) -cilk cxx -debug -doc (-fixed-point) fortran gcj -go -graphite hardened -jit (-libssp) (multilib) (-multislot) nls -nopie -nossp nptl -objc -objc++ -objc-gc openmp (pie) -regression-test (-sanitize) (ssp) -vanilla" ABI_X86="64"

Comment 1 Magnus Granberg gentoo-dev

2017-02-02 22:58:19 UTC

fixed in git
https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4fb479392663b9ea66a8eee9ce39b085e9bd1427

Comment 2 Magnus Granberg gentoo-dev

2017-02-02 22:59:35 UTC

*** Bug 508732 has been marked as a duplicate of this bug. ***